VulnerabilityModified
CVE-2016-1488
Cross-site scripting (XSS) vulnerability in the login form in the integrated web server on Siemens OZW OZW672 devices before 6.00 and OZW772 devices before 6.00 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
MEDIUM 6.1EPSS 1.23%
Does this matter?
Lower severity and a low EPSS score (1.23%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in the login form in the integrated web server on Siemens OZW OZW672 devices before 6.00 and OZW772 devices before 6.00 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
- CVSS 3.0
- 6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.23% probability · 67th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- siemens/ozw672 firmware · siemens/ozw772 firmware
- Source
- cve@mitre.org
References
- http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-743465.pdfVendor Advisory
- https://ics-cert.us-cert.gov/advisories/ICSA-16-019-01Third Party Advisory, US Government Resource
- http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-743465.pdfVendor Advisory
- https://ics-cert.us-cert.gov/advisories/ICSA-16-019-01Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.